@jonah so when behind the proxy, I am getting a social.privacytools.io cert for assets.privacytools.io cert some of the times. The cert has a different signature for Let's Encrypt and no ISRG Root.